CVE-2026-16056 Overview
CVE-2026-16056 affects the Contest Gallery WordPress plugin in versions before 30.0.7. The plugin fails to enforce capability checks or nonce validation in one of its request handlers. Any authenticated user, including those with the low-privilege Subscriber role, can invoke the handler and retrieve the site's entire stored OpenAI prompt history. The flaw is classified as Missing Authorization [CWE-862].
Critical Impact
Authenticated Subscriber-level users can read the complete stored OpenAI prompt history maintained by the plugin, exposing potentially sensitive content submitted through AI features.
Affected Products
- Contest Gallery WordPress plugin versions prior to 30.0.7
- WordPress sites running the vulnerable plugin with any user registration enabled
- Multisite deployments where Subscriber accounts are provisioned automatically
Discovery Timeline
- 2026-08-04 - CVE-2026-16056 published to NVD
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2026-16056
Vulnerability Analysis
The Contest Gallery plugin exposes an AJAX handler that returns the plugin's stored OpenAI prompt history. The handler skips two required WordPress access controls. It does not call current_user_can() to verify the caller holds an administrative capability, and it does not validate a nonce with check_ajax_referer() or wp_verify_nonce(). Because WordPress executes AJAX callbacks for any logged-in user by default when registered under the wp_ajax_ action prefix, any authenticated session can reach the handler.
The returned data set contains prompt records the plugin has captured from earlier AI-assisted operations. These records may include user-submitted text, contest-related metadata, and configuration fragments passed to OpenAI endpoints. Exposure is limited to information disclosure; the handler does not modify state or affect availability.
Root Cause
The root cause is a missing authorization control [CWE-862] on a data-retrieval endpoint. The plugin author placed sensitive read functionality behind authentication but did not scope it to administrators. The absence of a nonce also removes any request-origin binding, so the handler accepts direct API calls initiated by attacker-controlled scripts.
Attack Vector
An attacker first obtains any authenticated account, typically by registering as a Subscriber on sites that permit open registration. The attacker then issues an authenticated request to admin-ajax.php with the plugin's action parameter. The server responds with the stored prompt history in the response body. No user interaction from an administrator is required, and no additional privileges must be gained.
For technical specifics of the vulnerable handler, refer to the WPScan Vulnerability Report.
Detection Methods for CVE-2026-16056
Indicators of Compromise
- Requests to /wp-admin/admin-ajax.php from Subscriber-level session cookies referencing Contest Gallery action names
- Unusually large AJAX response payloads returned to non-administrative users
- New user registrations followed within minutes by AJAX activity targeting the plugin
Detection Strategies
- Inspect web server access logs for authenticated admin-ajax.php POST requests originating from accounts that hold only the Subscriber role
- Correlate WordPress user role assignments with the source of AJAX traffic to identify low-privilege accounts invoking plugin handlers
- Deploy a Web Application Firewall (WAF) rule to flag Contest Gallery AJAX actions issued by sessions without administrator capabilities
Monitoring Recommendations
- Enable WordPress audit logging to record AJAX action invocations along with the executing user role
- Alert on first-time invocation of Contest Gallery handlers by any user account created within the last 24 hours
- Track outbound response sizes for admin-ajax.php and investigate transfers that exceed typical baselines
How to Mitigate CVE-2026-16056
Immediate Actions Required
- Update the Contest Gallery plugin to version 30.0.7 or later on all WordPress instances
- Audit existing user accounts and remove unrecognized Subscriber registrations created before the patch was applied
- Rotate any credentials, API keys, or secrets that may have been referenced in stored OpenAI prompts
Patch Information
The vendor addressed the issue in Contest Gallery version 30.0.7 by adding capability and nonce checks to the affected handler. Administrators should apply the update through the WordPress plugin manager or by deploying the updated plugin package manually. See the WPScan Vulnerability Report for advisory details.
Workarounds
- Disable the Contest Gallery plugin until the patched version can be installed
- Disable open user registration by unsetting the users_can_register option in WordPress general settings
- Restrict access to admin-ajax.php for low-privilege roles using a WAF policy that blocks the vulnerable action name
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
